@zhivex-ai/harness 0.11.0 → 0.11.1

package/CHANGELOG.md

@@ -4,6 +4,34 @@ All notable changes to Zhivex Harness are documented in this file.
 
 The project follows Semantic Versioning. During `0.x`, minor releases may change user-facing contracts when the change is documented with a migration note. Patch releases remain backwards compatible bug fixes.
 
+## Unreleased
+
+## 0.11.1 - 2026-08-23
+
+### Changed
+
+- Make provider live certification a fail-closed dependency of the publish job and bind manual certification runs to an explicit release tag.
+- Remove release-version defaults from GitHub workflow inputs. Maintainers enter the annotated tag at dispatch, and release readiness validates it against the single version source in `package.json`.
+- Keep release-artifact transfer actions pinned to immutable commit SHAs while allowing Dependabot SHA upgrades, and represent successful remote tag-bound certification explicitly in the release-status schema.
+- Add a mutable machine-readable repository release-status record, keep it outside immutable npm artifacts, and validate public documentation, release gates, and repository security configuration against it.
+- Bound installed-package smoke subprocesses by time and captured output so a stalled child process cannot hang release validation indefinitely.
+- Keep public documentation consistent with the published `0.11.0` artifact while preserving live-provider certification as a separate evidence boundary.
+- Retry only transient HTTP failures in the opt-in base provider smoke, using fresh temporary state and a bounded three-attempt schedule; contract and approval failures still fail immediately.
+- Preserve transient provider status from failed agent outputs before release-smoke contract assertions so retryable 429/5xx responses reach the bounded retry loop.
+- Mark create-only `expectedDigest: null` as an explicitly required tool-schema field and reinforce that contract in live certification prompts for providers that otherwise omit null-valued arguments.
+- Record current worktree live evidence separately from release-bound certification: the certified cohort passed every local gate, while Gemini Flash 3.7 passed base editing and delegation but remained blocked on provider quota/capacity during OCI execution.
+
+### Security
+
+- Add CodeQL, Dependabot, CODEOWNERS, and documented public-repository security controls. GitHub-side controls that are free for public repositories are enabled; optional cost-bearing analysis remains disabled and explicitly recorded. Live provider credentials are scoped only to the final provider-call step rather than checkout, setup, dependency installation, or deterministic validation.
+- Bind workspace, context, OCI, change-envelope, and release-artifact reads to bounded regular-file descriptors that reject symbolic links, hard-linked OCI exports, special files, and concurrent content replacement.
+- Create SQLite state files and benchmark canaries exclusively, stage release archives from the exact inspected bytes, pin registry identity independently of package metadata, and classify adversarial benchmark failures with a linear complete-token scanner.
+- Recover canonical `.cleanup-<artifact>-<uuid>` OCI artifact directories after interrupted cleanup without weakening inode and metadata revalidation.
+
+### Migration from 0.11.0
+
+No configuration, SQLite, approval, or execution-policy migration is required. Existing `0.11.0` state remains compatible; this patch tightens failure classification, cleanup recovery, and release boundaries.
+
 ## 0.11.0 - 2026-08-21
 
 ### Added

package/README.md

@@ -13,7 +13,7 @@ Zhivex Harness runs coding agents against real repositories with conflict-safe e
 
 The model provides capability. The harness controls what it may inspect, execute, change, resume, and prove. Every provider uses the same bounded tool and approval contract.
 
-Version `0.11.0` is the current source release candidate. The latest public npm release remains the tagged Node-first `0.10.0` artifact until the reviewed release workflow publishes and verifies `0.11.0`; local validation alone does not publish or certify registry provenance. See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), the [change-envelope guide](./docs/CHANGE_ENVELOPES.md), the [CLI contract](./docs/CLI.md), the [context-engineering guide](./docs/CONTEXT_ENGINEERING.md), the [extensibility guide](./docs/EXTENSIBILITY.md), and the [durable-operations guide](./docs/DURABLE_OPERATIONS.md).
+Version `0.11.1` is the current source release candidate; `0.11.0` remains the public npm release and `latest` distribution tag until protected publication completes. Candidate provenance and certification are pending in the [repository release status](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json). Publication is fail-closed on deterministic, installed-package, real-OCI, base-provider, orchestration, routing, and model-directed execution gates. See [ROADMAP.md](./ROADMAP.md), [CHANGELOG.md](./CHANGELOG.md), [public repository security](./docs/PUBLIC_SECURITY.md), the [change-envelope guide](./docs/CHANGE_ENVELOPES.md), the [CLI contract](./docs/CLI.md), the [context-engineering guide](./docs/CONTEXT_ENGINEERING.md), the [extensibility guide](./docs/EXTENSIBILITY.md), and the [durable-operations guide](./docs/DURABLE_OPERATIONS.md).
 
 ## Why Zhivex Harness
 
@@ -109,10 +109,10 @@ It does not include arbitrary host shell access, `stdio` MCP, permanent deletion
 
 ## Installation
 
-Install the published Node-first `0.10.0` artifact with an exact version:
+After protected publication, install the Node-first `0.11.1` artifact with an exact version:
 
 ```bash
-npx --yes --package=@zhivex-ai/harness@0.10.0 zhx --version
+npx --yes --package=@zhivex-ai/harness@0.11.1 zhx --version
 ```
 
 To exercise the source checkout, contributors use Bun for deterministic repository tooling while the built CLI itself runs on Node:
@@ -289,7 +289,7 @@ zhivex-harness run --execution oci --oci-shell ask "use a reviewed shell pipelin
 
 Override any model with `--model`. Optional provider overrides are `META_BASE_URL`, `QWEN_BASE_URL`, `QWEN_WORKSPACE_ID`, `QWEN_REGION`, `OPENAI_BASE_URL`, and `GEMINI_BASE_URL`. Non-credential transport settings are hash-bound to durable resumes without persisting their values.
 
-Meta and Qwen retain the published support conclusion for the unchanged approval/restart and delegation paths. OpenAI remains GPT-5.6-first from `0.8.0`: Luna is the default, while Terra and Sol remain explicit `--model` selections. The tagged Node-first `0.10.0` artifact is published; the `0.11.0` candidate requires its own clean CI, live-provider, artifact, registry, and provenance gates. Controlled and official-SDK MCP interoperability are verified separately and do not imply compatibility with every server or protocol feature. Provider capability claims remain artifact- and date-bound under the [live certification contract](./docs/LIVE_CERTIFICATION.md); credential detection and deterministic tests do not replace real provider evidence.
+Meta and Qwen retain the published support conclusion for the unchanged approval/restart and delegation paths. OpenAI remains GPT-5.6-first from `0.8.0`: Luna is the default, while Terra and Sol remain explicit `--model` selections. The tagged Node-first `0.11.0` artifact is published with registry integrity and provenance; its release-bound remote provider matrix remains pending and is not implied by publication. Controlled and official-SDK MCP interoperability are verified separately and do not imply compatibility with every server or protocol feature. Provider capability claims remain artifact- and date-bound under the [live certification contract](./docs/LIVE_CERTIFICATION.md); credential detection and deterministic tests do not replace real provider evidence.
 
 ## Security boundaries
 

package/ROADMAP.md

@@ -3,7 +3,7 @@
 - Status: active
 - Baseline date: 2026-08-21
 
-This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, and `0.5.0` through `0.10.0` are published on npm. Version `0.11.0` is the local source release candidate for interactive operation, context engineering, and opt-in OCI shell workflows; publication and release certification remain separate operations. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
+This roadmap takes the harness from its `0.1.0` MVP to a stable CLI and library contract. The `0.2.0` source baseline is tagged locally, `0.3.0` and `0.4.0` are private checkpoints, and `0.5.0` through `0.11.0` are published on npm. Version `0.11.1` is the local source release candidate for file and release hardening without a `0.11.x` contract change. It is not yet tagged or published as a new artifact; registry publication, supply-chain provenance, and provider certification remain separate evidence boundaries. Releases are ordered by dependency and safety risk, not by calendar date. A version ships only when its exit criteria are satisfied.
 
 ## Planning principles
 
@@ -44,7 +44,8 @@ The `0.6.0` dependency batch pins and overrides `@zhivex-ai/core@1.6.0`, retaini
 | `0.8.0` | SDK refresh and GPT-5.6 | One Core runtime, current adapters, and a GPT-5.6-first OpenAI path | Published on npm | M |
 | `0.9.0` | Fast governed change admission | Lower repository/OCI overhead plus portable offline evidence bound to exact patch bytes | Published on npm | L |
 | `0.10.0` | Node-first portability | Node CLI/library, portable SQLite/processes, manager-aware checks, and Node OCI | Published on npm | L |
-| `0.11.0` | Daily-driver foundations | Richer terminal operation, governed context/skills/hooks, and opt-in OCI shell | Local release candidate | L |
+| `0.11.0` | Daily-driver foundations | Richer terminal operation, governed context/skills/hooks, and opt-in OCI shell | Published on npm | L |
+| `0.11.1` | Security and release hardening | Bounded reads, recoverable cleanup, and fail-closed release evidence | Local release candidate | S |
 | `1.0.0` | Stable contract | Supported compatibility and release guarantees | Planned | L |
 
 Relative size is for sequencing only; dates require a capacity decision.
@@ -313,7 +314,7 @@ Exit criteria:
 
 ## 0.11.0 — daily-driver foundations
 
-Status: local source release candidate. It is not yet tagged or published as a new artifact.
+Status: published on npm as `latest` with annotated tag `v0.11.0`, exact registry integrity, and SLSA provenance. Release-bound remote provider certification remains pending and is not implied by publication.
 
 Goal: make the governed runtime practical for daily interactive work without giving repository content or shell syntax authority over host policy.
 
@@ -330,6 +331,26 @@ Exit criteria:
 - TTY, no-color, approval-resume, context traversal/symlink, skill disclosure, hook redaction/failure, and OCI shell policy regressions pass.
 - The full deterministic, package, and real-OCI gates pass from a clean commit before any release number, tag, or publication is claimed.
 
+## 0.11.1 — security and release hardening
+
+Status: local source release candidate. It is not yet tagged or published as a new artifact; provenance and release-bound live certification remain pending.
+
+Goal: ship the reviewed security and release hardening accumulated after `0.11.0` without changing configuration, durable state, or execution-policy contracts.
+
+Scope:
+
+- bind sensitive reads and release archive staging to bounded, no-follow regular-file snapshots;
+- recover cleanup directories left by interrupted OCI artifact deletion;
+- preserve transient provider status through the live-smoke retry boundary;
+- classify tool failures with complete tokens in one linear scan; and
+- keep publication fail-closed on the exact tag, tarball, live-provider matrix, registry integrity, and provenance.
+
+Exit criteria:
+
+- focused security regressions, the complete deterministic gate, installed-package smoke, and real OCI pass;
+- the exact annotated tag passes base, orchestration, routing, and model-directed live execution; and
+- npm `latest`, tarball SHA-512, SLSA provenance, tag, and source commit agree.
+
 ## 1.0.0 — Stable CLI and library contract
 
 Goal: freeze a supportable public contract after the pre-1.0 safety and operational surfaces have been exercised in real repositories.
@@ -375,8 +396,8 @@ These can become separate post-1.0 tracks after the CLI/runtime contract and sec
 
 ## Immediate next actions
 
-1. Review and commit the exact `0.11.0` source candidate on `main`, then require clean Linux/macOS CI and Node 22.13/24 artifact compatibility.
-2. Run the required real-OCI gate against `node:24-bookworm-slim` plus installed-artifact smoke coverage for terminal, context, lifecycle-hook, and OCI shell exports.
-3. Complete the provider live matrices affected by the changed context/tool fingerprint; keep any missing or failed path outside the certified release evidence.
-4. Create annotated tag `v0.11.0` from the reviewed release commit and dispatch the protected workflow only after confirming npm still lacks that immutable version.
-5. Verify the exact published tarball, `latest` tag, integrity, and SLSA provenance before calling `0.11.0` released.
+1. Configure maintainer-approved provider secrets in the protected `live-certification` environment and run the complete release-bound matrix against the exact annotated tag.
+2. Keep publication fail-closed on base, orchestration, routing, model-directed OCI execution, exact-artifact, integrity, and provenance evidence.
+3. Stabilize the CLI, config, JSON/event, library export, state migration, and error contracts required for the first `1.0.0` release candidate.
+4. Publish the support matrix, threat model, migration/export path, and representative cross-provider repository evaluation evidence.
+5. Complete two release candidates without a contract-breaking defect before promoting `1.0.0` to `latest`.

package/SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Supported versions
 
-Security fixes are provided for the latest published `0.8.x` version. The `0.9.x` source candidate and older private checkpoints are not supported release channels until their exact artifacts are published and verified.
+Security fixes are provided for the latest published `0.11.x` patch. Older minors and private checkpoints are not supported release channels. Registry integrity and provenance do not substitute for the separate provider and execution evidence recorded in [docs/LIVE_CERTIFICATION.md](./docs/LIVE_CERTIFICATION.md).
 
 ## Reporting a vulnerability
 
@@ -14,7 +14,9 @@ Do not open a public issue for a suspected vulnerability. Use [GitHub private vu
 - the practical impact; and
 - any suggested mitigation.
 
-Private vulnerability reporting must be enabled before the repository is made public. If that channel is unavailable, do not disclose exploit details in a public issue.
+Private vulnerability reporting is enabled for this public repository. If GitHub reports that the channel is unavailable, do not disclose exploit details in a public issue; wait for the maintainers to restore the private channel.
+
+The enabled no-cost public controls and the explicitly cost-gated features left disabled are recorded in [docs/PUBLIC_SECURITY.md](./docs/PUBLIC_SECURITY.md).
 
 ## Scope
 

package/SUPPORT.md

@@ -1,6 +1,6 @@
 # Support
 
-Zhivex Harness `0.10.x` is a pre-1.0 Node-first CLI and TypeScript library. Observable contracts may change in a later minor release when the change and migration path are documented in [CHANGELOG.md](./CHANGELOG.md). The source checkout may be a release candidate newer than the latest public npm artifact.
+Zhivex Harness `0.11.x` is the latest supported pre-1.0 Node-first CLI and TypeScript library. Observable contracts may change in a later minor release when the change and migration path are documented in [CHANGELOG.md](./CHANGELOG.md). The mutable machine-readable public release state is recorded in the repository [release-status.json](https://raw.githubusercontent.com/Zhivex/zhivex-harness/main/release-status.json), outside immutable npm artifacts.
 
 ## Supported baseline
 
@@ -11,7 +11,7 @@ Zhivex Harness `0.10.x` is a pre-1.0 Node-first CLI and TypeScript library. Obse
 - the provider/model combinations marked certified in the package documentation; and
 - HTTPS or explicitly allowed loopback-HTTP MCP endpoints using the documented bounded JSON-RPC subset.
 
-Only the most recent published patch receives routine fixes. Meta and Qwen retain their date-bound certification, OpenAI GPT-5.6 has local `0.8.0` base-gate evidence, and Gemini remains provisional until the complete harness live matrix passes. Live provider evidence is account-, model-, endpoint-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](./docs/LIVE_CERTIFICATION.md).
+Only the most recent published `0.11.x` patch receives routine fixes. The exact `v0.11.0` tag source has date-bound local base and orchestration evidence for Meta, Qwen, and OpenAI plus OpenAI-to-Qwen routing evidence. The `0.11.1` candidate must pass the protected release-bound matrix before publication, and Gemini remains provisional until its complete harness live matrix passes. Live provider evidence is account-, model-, endpoint-, artifact-, and date-dependent; see [docs/LIVE_CERTIFICATION.md](./docs/LIVE_CERTIFICATION.md).
 
 ## Support channels